1*2175Sjp161948=pod 2*2175Sjp161948 3*2175Sjp161948=head1 NAME 4*2175Sjp161948 5*2175Sjp161948PKCS7_decrypt - decrypt content from a PKCS#7 envelopedData structure 6*2175Sjp161948 7*2175Sjp161948=head1 SYNOPSIS 8*2175Sjp161948 9*2175Sjp161948int PKCS7_decrypt(PKCS7 *p7, EVP_PKEY *pkey, X509 *cert, BIO *data, int flags); 10*2175Sjp161948 11*2175Sjp161948=head1 DESCRIPTION 12*2175Sjp161948 13*2175Sjp161948PKCS7_decrypt() extracts and decrypts the content from a PKCS#7 envelopedData 14*2175Sjp161948structure. B<pkey> is the private key of the recipient, B<cert> is the 15*2175Sjp161948recipients certificate, B<data> is a BIO to write the content to and 16*2175Sjp161948B<flags> is an optional set of flags. 17*2175Sjp161948 18*2175Sjp161948=head1 NOTES 19*2175Sjp161948 20*2175Sjp161948OpenSSL_add_all_algorithms() (or equivalent) should be called before using this 21*2175Sjp161948function or errors about unknown algorithms will occur. 22*2175Sjp161948 23*2175Sjp161948Although the recipients certificate is not needed to decrypt the data it is needed 24*2175Sjp161948to locate the appropriate (of possible several) recipients in the PKCS#7 structure. 25*2175Sjp161948 26*2175Sjp161948The following flags can be passed in the B<flags> parameter. 27*2175Sjp161948 28*2175Sjp161948If the B<PKCS7_TEXT> flag is set MIME headers for type B<text/plain> are deleted 29*2175Sjp161948from the content. If the content is not of type B<text/plain> then an error is 30*2175Sjp161948returned. 31*2175Sjp161948 32*2175Sjp161948=head1 RETURN VALUES 33*2175Sjp161948 34*2175Sjp161948PKCS7_decrypt() returns either 1 for success or 0 for failure. 35*2175Sjp161948The error can be obtained from ERR_get_error(3) 36*2175Sjp161948 37*2175Sjp161948=head1 BUGS 38*2175Sjp161948 39*2175Sjp161948PKCS7_decrypt() must be passed the correct recipient key and certificate. It would 40*2175Sjp161948be better if it could look up the correct key and certificate from a database. 41*2175Sjp161948 42*2175Sjp161948The lack of single pass processing and need to hold all data in memory as 43*2175Sjp161948mentioned in PKCS7_sign() also applies to PKCS7_verify(). 44*2175Sjp161948 45*2175Sjp161948=head1 SEE ALSO 46*2175Sjp161948 47*2175Sjp161948L<ERR_get_error(3)|ERR_get_error(3)>, L<PKCS7_encrypt(3)|PKCS7_encrypt(3)> 48*2175Sjp161948 49*2175Sjp161948=head1 HISTORY 50*2175Sjp161948 51*2175Sjp161948PKCS7_decrypt() was added to OpenSSL 0.9.5 52*2175Sjp161948 53*2175Sjp161948=cut 54